Rights management system for streamed multimedia content

ABSTRACT

A computing device segregates licenses for corresponding content according to relatively short lived licenses for relatively short lived content and relatively long lived licenses for relatively long lived content. The computing device stores the relatively short lived licenses in a more temporary and volatile license store, and the relatively long lived licenses in a more permanent and non-volatile license store. Thus, the relatively short lived licenses are deleted when the temporary license store is turned off and do not create disorder in the permanent license store.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application shares a common disclosure with:

U.S. patent application Ser. No. 11/112,325 and entitled “RightsManagement System for Streamed Multimedia Content”,

U.S. patent application Ser. No. 11/113,215 and entitled “RightsManagement System for Streamed Multimedia Content”, and

U.S. patent application Ser. No. 11/113,216 and entitled “RightsManagement System for Streamed Multimedia Content”,

all of which are filed concurrently, and all of which are herebyincorporated by reference in their entirety.

TECHNICAL FIELD

The present invention relates to a rights management (RM) system wherebyaccess to streamed digital content is provided only in accordance with acorresponding digital license. More particularly, the invention relatesto systems and methods employed by such an RM system for handling thestreamed content.

BACKGROUND OF THE INVENTION

Rights management (RM) and enforcement is highly desirable in connectionwith digital content such as digital audio, digital video, digital text,digital data, digital multimedia, etc., where such digital content is tobe distributed to one or more users. Digital content could be static,such as a text document, for example, or it could be streamed, such asthe streamed audio and video of a multimedia presentation. Typical modesof distribution of such streamed content include tangible and intangibleforms such as an optical disk, a cable-access feed, a feed from anelectronic network such as the Internet, a feed from an over-the-airbroadcast, etc. Upon being received by a user at an appropriatecomputing device thereof, such user renders the streamed digital contentwith the aid of the computing device, appropriate rendering software,and appropriate output devices such as speakers, a video monitor, etc.

In one scenario, the streamed content is distributed by a distributor aspart of a subscription service, such as for example a digital televisionservice, and the streamed content as distributed is either protected,such as for example by being encrypted, or is unprotected. If it is thecase that the streamed content is indeed distributed in an unprotectedform, it may be the case that the distributor primarily intends for thestreamed content to be immediately consumed and rendered, and not storedin any meaningful retrievable form. For example, the streamed contentmay be one of many streams of content in a digital cable televisionsignal that is to be received by a digital cable set-top box andimmediately rendered thereby, and is then to be forwarded to theaforementioned appropriate output devices.

However, it is to be appreciated that storage systems exist and/or arebeing developed that can indeed store the streamed content for laterrendering and/or re-distribution to other computing devices. With regardto such storage systems, then, the distributor of the streamedunprotected content would rather not have such unprotected contentstored in the unprotected form and without any ability to restrict suchre-distribution, if so desired. In particular, the distributor or thelike may wish to prohibit the user from copying such streamed content toanother storage system or the like, may wish to allow the user to copywith temporal and/or count restrictions, or the like. As may beappreciated, by prohibiting unlimited copying of the streamed content,the distributor can avoid the unchecked dispersal of pristine digitalcopies of the streamed content, where such unchecked dispersal wouldencourage other users from foregoing from subscribing to thesubscription service offered by such distributor.

In addition, the distributor may wish to provide various users withdifferent rendering rights. For example, the distributor may offerdifferent tiers of service, where higher-level tiers correspondinglycommand higher subscription fees, and where a user subscribing at aparticular tier should not be allowed to access streamed content fromhigher tiers in an unprotected form.

Note, though, that after the streamed content has been distributed, thedistributor has very little if any real control over the streamedcontent. This is especially problematic in view of the fact that mostany personal computer includes the software and hardware necessary tomake an exact digital copy of such streamed content, and to downloadsuch exact digital copy to a re-distribution medium such as an opticaldisk, or to send such exact digital copy over a network such as theInternet to any destination.

Of course, as part of a transaction wherein the streamed content issubscribed to, the distributor may require the user/recipient of thestreamed content to promise not to re-distribute such content in anunwelcome manner. However, such a promise is easily made and easilybroken. The distributor may attempt to prevent such re-distributionthrough any of several known security devices, usually involvingencryption and decryption. However, such security devices if especiallysimple pose little problem to a mildly determined user who wishes todecrypt encrypted content, save such content in an un-encrypted form,and then re-distribute same.

RM and enforcement architectures and methods have thus been provided toallow the controlled rendering of arbitrary forms of digital contentincluding streamed content, where such control is flexible and definableby the distributor or the like of such digital content. Sucharchitectures allow and facilitate such controlled rendering in thescenario as set forth above.

In one particular arrangement, the streamed content is one of aplurality of streams of such content provided as a combined signal to areceiver. The receiver selects a particular one of the streams uponcommand from a media system, and provides the selected stream to suchmedia system for further processing. Notably, the selected stream asprovided to the receiver is unprotected, but prior to being provided tothe media system the selected stream is in fact protected by thereceiver according to a particular RM encryption system.

Typically, in an RM encryption system, the content is protected by beingencrypted according to a content key (CK). Inasmuch as symmetricencryption and decryption is easier, faster, and less expensive thanasymmetric encryption and decryption, such content key (CK) is typicallysymmetric. Also typically, the content key (CK) is provided by anencryptor such as the receiver to a decryptor such as the media systemin an encrypted form and as part of a digital license or the like thatspecifies license rules that must be satisfied before such content isallowed to be decrypted and rendered by the decryptor/media system.

In the circumstance where the streamed content is one of a plurality ofdigital television signals that may in effect be tuned by the receiverat the command of the media system, it is to be appreciated that thereceiver can be expected to receive commands from the media system totune in different digital signals on a fairly regular basis, perhaps onthe order of as much as once every one-half to one second, especially ifthe user of the media system is in effect skimming through or ‘surfing’several signals. However, and recognizing that each newly tuned signalrequires a new license from the receiver, it is to be appreciated thatconstructing such new license and sending same from the receiver to themedia system can be quite burdensome, especially if the license isdetailed, includes encrypted elements, includes a digital signature, orthe like. Thus, it likely cannot be expected that the receivercompletely creates a new license every time the media system commandssuch receiver to tune a different digital signal, especially if thefrequency of such commands is on the order of seconds.

A need exists then, for a system and method for the receiver to create ashortened version of requirements that would go into such a new licensesuch that the receiver need not go to the burden of in fact completelycreating such new license every time such receiver newly tunes a digitalsignal. In particular, a need exists for such a shortened version ofsuch requirements that can be quickly created and sent to the mediasystem each time the receiver newly tunes a digital signal, even if theuser is commanding a change on the order of once every second or so.Additionally, a need exists for such a shortened version of suchrequirements that is concise and yet describes all license requirementsfor the tuned digital signal in a minimal amount of space. Finally, aneed exists for such a shortened version of such requirements that canbe employed in connection with streamed digital content as provided tothe media system from sources other than the receiver.

Also recognizing that each newly tuned signal may be encrypted by thereceiver according to a different content key (CK), it is to beappreciated that informing the media system of such content key (CK) byplacing same in a new license and sending same from the receiver to themedia system can likewise be quite burdensome. Again, it likely cannotbe expected that the receiver completely creates a new license with anew content key (CK) every time the media system commands such receiverto tune a different digital signal, especially if the frequency of suchcommands is on the order of seconds.

A need exists then, for a system and method for sharing each new contentkey (CK) between the receiver and the media system without the need forcreating an actual license with each such content key (CK) therein. Inparticular, a need exists for a method by which the receiver and mediasystem can exchange an initial content key and then rotate content keysbased on the initial content key. Additionally, a need exists for such amethod whereby the receiver and the media system rotate keys in acoordinated fashion.

Further recognizing that the requirements corresponding to a newly tunedsignal may be located within the signal on a periodic basis, but thatsuch periodicity may be a relatively long period of time, it is to beappreciated that it may be unreasonable to make the media system waitsuch a relatively long period of time until such requirements are infact located within such signal. Especially in the situation where thereceiver is tuning in different digital signals on a fairly regularbasis, perhaps on the order of as much as once every one-half to onesecond, it likely cannot be expected that the receiver can wait therelatively long period of time to locate the requirements within thenewly tuned signal.

A need exists then, for a system and method for the receiver to send adefault set of requirements on a preliminary basis, and then an actualset of requirements when actually located. In particular, a need existsfor a method by which the receiver can send such default requirements tobe employed by the media system until the actual requirements are sent.Additionally, a need exists for such a method whereby the media systemcan distinguish between such default requirements and such correspondingactual requirements and can replace the default requirements with thecorresponding actual requirements upon receipt thereof.

Finally recognizing that the media system likely will store a relativelylarge amount of licenses corresponding to newly tuned signals, but thatmany if not most of such licenses are not needed for very long, it is tobe appreciated that such licenses should for the most part be stored ononly a temporary basis. Once again, in the situation where the receiveris tuning in different digital signals on a fairly regular basis,perhaps on the order of as much as once every one-half to one second, itlikely cannot be expected that all of the corresponding licenses ascreated and stored by the media system should or could be made availableon a permanent basis.

A need exists then, for a system and method for the media system tostore at least some licenses corresponding to tuned signals only on atemporary basis. In particular, a need exists for a method by which themedia system can recognize which licenses need only be stored on atemporary basis. Additionally, a need exists for such a method wherebythe media system deletes such temporarily stored licenses.

SUMMARY OF THE INVENTION

The aforementioned needs are satisfied at least in part by the presentinvention in which a method is provided for a computing device to storedigital licenses for rendering corresponding pieces of digital content.In the method, the computing device segregates the licenses according torelatively short lived licenses for relatively short lived content andrelatively long lived licenses for relatively long lived content. Thecomputing device stores the relatively short lived licenses in a moretemporary and volatile license store, and the relatively long livedlicenses in a more permanent and non-volatile license store. Thus, therelatively short lived licenses are deleted when the temporary licensestore is turned off and do not create disorder in the permanent licensestore.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing summary, as well as the following detailed description ofthe embodiments of the present invention, will be better understood whenread in conjunction with the appended drawings. For the purpose ofillustrating the invention, there are shown in the drawings embodimentswhich are presently preferred. As should be understood, however, theinvention is not limited to the precise arrangements andinstrumentalities shown. In the drawings:

FIG. 1 is a block diagram representing an exemplary non-limitingcomputing environment in which the present invention may be implemented;

FIG. 2 is a block diagram representing an exemplary network environmenthaving a variety of computing devices in which the present invention maybe implemented;

FIG. 3 is a block diagram showing an enforcement architecture of anexample of a trust-based system, including a digital license forrendering corresponding digital content in accordance with variousembodiments of the present invention;

FIG. 4 is a block diagram showing an example of the trust-based systemof FIG. 3, and in particular shows a receiver forwarding an encryptedstream of content to a media system for rendering thereby in accordancewith various embodiments of the present invention;

FIG. 5 is a block diagram showing an abbreviated version of requirementsin connection with the encrypted content of FIG. 4 and as sent by thereceiver of FIG. 4 to the media system of FIG. 4 in accordance with oneembodiment of the present invention; and

FIGS. 6-9 are flow diagrams showing key steps performed by the receiverand media system of FIG. 4 in accordance with various embodiments of thepresent invention, including the receiver sending the requirements ofFIG. 5 to the media system (FIG. 6), the receiver and the media systemeach deriving a content key (CK) for a newly tuned stream (FIG. 7), thereceiver sending a default derived message with default requirements tothe media system for a newly tuned stream prior to encounteringinformation in the stream from which actual requirements can beconstructed (FIG. 8), and the media system employing a temporary licensestore and deleting marked licenses therefrom by way of a housekeepingfunction (FIG. 9).

DETAILED DESCRIPTION OF THE INVENTION

Computer Environment

FIG. 1 and the following discussion are intended to provide a briefgeneral description of a suitable computing environment in which theinvention may be implemented. It should be understood, however, thathandheld, portable, and other computing devices of all kinds arecontemplated for use in connection with the present invention. While ageneral purpose computer is described below, this is but one example,and the present invention requires only a thin client having networkserver interoperability and interaction. Thus, the present invention maybe implemented in an environment of networked hosted services in whichvery little or minimal client resources are implicated, e.g., anetworked environment in which the client device serves merely as abrowser or interface to the World Wide Web.

Although not required, the invention can be implemented via anapplication programming interface (API), for use by a developer, and/orincluded within the network browsing software which will be described inthe general context of computer-executable instructions, such as programmodules, being executed by one or more computers, such as clientworkstations, servers, or other devices. Generally, program modulesinclude routines, programs, objects, components, data structures and thelike that perform particular tasks or implement particular abstract datatypes. Typically, the functionality of the program modules may becombined or distributed as desired in various embodiments. Moreover,those skilled in the art will appreciate that the invention may bepracticed with other computer system configurations. Other well knowncomputing systems, environments, and/or configurations that may besuitable for use with the invention include, but are not limited to,personal computers (PCs), automated teller machines, server computers,hand-held or laptop devices, multi-processor systems,microprocessor-based systems, programmable consumer electronics, networkPCs, minicomputers, mainframe computers, and the like. The invention mayalso be practiced in distributed computing environments where tasks areperformed by remote processing devices that are linked through acommunications network or other data transmission medium. In adistributed computing environment, program modules may be located inboth local and remote computer storage media including memory storagedevices.

FIG. 1 thus illustrates an example of a suitable computing systemenvironment 100 in which the invention may be implemented, although asmade clear above, the computing system environment 100 is only oneexample of a suitable computing environment and is not intended tosuggest any limitation as to the scope of use or functionality of theinvention. Neither should the computing environment 100 be interpretedas having any dependency or requirement relating to any one orcombination of components illustrated in the exemplary operatingenvironment 100.

With reference to FIG. 1, an exemplary system for implementing theinvention includes a general purpose computing device in the form of acomputer 110. Components of computer 110 may include, but are notlimited to, a processing unit 120, a system memory 130, and a system bus121 that couples various system components including the system memoryto the processing unit 120. The system bus 121 may be any of severaltypes of bus structures including a memory bus or memory controller, aperipheral bus, and a local bus using any of a variety of busarchitectures. By way of example, and not limitation, such architecturesinclude Industry Standard Architecture (ISA) bus, Micro ChannelArchitecture (MCA) bus, Enhanced ISA (EISA) bus, Video ElectronicsStandards Association (VESA) local bus, and Peripheral ComponentInterconnect (PCI) bus (also known as Mezzanine bus).

Computer 110 typically includes a variety of computer readable media.Computer readable media can be any available media that can be accessedby computer 110 and includes both volatile and nonvolatile media,removable and non-removable media. By way of example, and notlimitation, computer readable media may comprise computer storage mediaand communication media. Computer storage media includes both volatileand nonvolatile, removable and non-removable media implemented in anymethod or technology for storage of information such as computerreadable instructions, data structures, program modules or other data.Computer storage media includes, but is not limited to, RAM, ROM,EEPROM, flash memory or other memory technology, CDROM, digitalversatile disks (DVD) or other optical disk storage, magnetic cassettes,magnetic tape, magnetic disk storage or other magnetic storage devices,or any other medium which can be used to store the desired informationand which can be accessed by computer 110. Communication media typicallyembodies computer readable instructions, data structures, programmodules or other data in a modulated data signal such as a carrier waveor other transport mechanism and includes any information deliverymedia. The term “modulated data signal” means a signal that has one ormore of its characteristics set or changed in such a manner as to encodeinformation in the signal. By way of example, and not limitation,communication media includes wired media such as a wired network ordirect-wired connection, and wireless media such as acoustic, RF,infrared, and other wireless media. Combinations of any of the aboveshould also be included within the scope of computer readable media.

The system memory 130 includes computer storage media in the form ofvolatile and/or nonvolatile memory such as read only memory (ROM) 131and random access memory (RAM) 132. A basic input/output system 133(BIOS), containing the basic routines that help to transfer informationbetween elements within computer 110, such as during start-up, istypically stored in ROM 131. RAM 132 typically contains data and/orprogram modules that are immediately accessible to and/or presentlybeing operated on by processing unit 120. By way of example, and notlimitation, FIG. 1 illustrates operating system 134, applicationprograms 135, other program modules 136, and program data 137.

The computer 110 may also include other removable/non-removable,volatile/nonvolatile computer storage media. By way of example only,FIG. 1 illustrates a hard disk drive 141 that reads from or writes tonon-removable, nonvolatile magnetic media, a magnetic disk drive 151that reads from or writes to a removable, nonvolatile magnetic disk 152,and an optical disk drive 155 that reads from or writes to a removable,nonvolatile optical disk 156, such as a CD ROM or other optical media.Other removable/non-removable, volatile/nonvolatile computer storagemedia that can be used in the exemplary operating environment include,but are not limited to, magnetic tape cassettes, flash memory cards,digital versatile disks, digital video tape, solid state RAM, solidstate ROM, and the like. The hard disk drive 141 is typically connectedto the system bus 121 through a non-removable memory interface such asinterface 140, and magnetic disk drive 151 and optical disk drive 155are typically connected to the system bus 121 by a removable memoryinterface, such as interface 150.

The drives and their associated computer storage media discussed aboveand illustrated in FIG. 1 provide storage of computer readableinstructions, data structures, program modules and other data for thecomputer 110. In FIG. 1, for example, hard disk drive 141 is illustratedas storing operating system 144, application programs 145, other programmodules 146, and program data 147. Note that these components can eitherbe the same as or different from operating system 134, applicationprograms 135, other program modules 136, and program data 137. Operatingsystem 144, application programs 145, other program modules 146, andprogram data 147 are given different numbers here to illustrate that, ata minimum, they are different copies. A user may enter commands andinformation into the computer 110 through input devices such as akeyboard 162 and pointing device 161, commonly referred to as a mouse,trackball or touch pad. Other input devices (not shown) may include amicrophone, joystick, game pad, satellite dish, scanner, or the like.These and other input devices are often connected to the processing unit120 through a user input interface 160 that is coupled to the system bus121, but may be connected by other interface and bus structures, such asa parallel port, game port or a universal serial bus (USB).

A monitor 191 or other type of display device is also connected to thesystem bus 121 via an interface, such as a video interface 190. Agraphics interface 182, such as Northbridge, may also be connected tothe system bus 121. Northbridge is a chipset that communicates with theCPU, or host processing unit 120, and assumes responsibility foraccelerated graphics port (AGP) communications. One or more graphicsprocessing units (GPUs) 184 may communicate with graphics interface 182.In this regard, GPUs 184 generally include on-chip memory storage, suchas register storage and GPUs 184 communicate with a video memory 186.GPUs 184, however, are but one example of a coprocessor and thus avariety of co-processing devices may be included in computer 110. Amonitor 191 or other type of display device is also connected to thesystem bus 121 via an interface, such as a video interface 190, whichmay in turn communicate with video memory 186. In addition to monitor191, computers may also include other peripheral output devices such asspeakers 197 and printer 196, which may be connected through an outputperipheral interface 195.

The computer 110 may operate in a networked environment using logicalconnections to one or more remote computers, such as a remote computer180. The remote computer 180 may be a personal computer, a server, arouter, a network PC, a peer device or other common network node, andtypically includes many or all of the elements described above relativeto the computer 110, although only a memory storage device 181 has beenillustrated in FIG. 1. The logical connections depicted in FIG. 1include a local area network (LAN) 171 and a wide area network (WAN)173, but may also include other networks. Such networking environmentsare commonplace in offices, enterprise-wide computer networks, intranetsand the Internet.

When used in a LAN networking environment, the computer 110 is connectedto the LAN 171 through a network interface or adapter 170. When used ina WAN networking environment, the computer 110 typically includes amodem 172 or other means for establishing communications over the WAN173, such as the Internet. The modem 172, which may be internal orexternal, may be connected to the system bus 121 via the user inputinterface 160, or other appropriate mechanism. In a networkedenvironment, program modules depicted relative to the computer 110, orportions thereof, may be stored in the remote memory storage device. Byway of example, and not limitation, FIG. 1 illustrates remoteapplication programs 185 as residing on memory device 181. It will beappreciated that the network connections shown are exemplary and othermeans of establishing a communications link between the computers may beused.

One of ordinary skill in the art can appreciate that a computer 110 orother client device can be deployed as part of a computer network. Inthis regard, the present invention pertains to any computer systemhaving any number of memory or storage units, and any number ofapplications and processes occurring across any number of storage unitsor volumes. The present invention may apply to an environment withserver computers and client computers deployed in a network environment,having remote or local storage. The present invention may also apply toa standalone computing device, having programming languagefunctionality, interpretation and execution capabilities.

Distributed computing facilitates sharing of computer resources andservices by direct exchange between computing devices and systems. Theseresources and services include the exchange of information, cachestorage, and disk storage for files. Distributed computing takesadvantage of network connectivity, allowing clients to leverage theircollective power to benefit the entire enterprise. In this regard, avariety of devices may have applications, objects or resources that mayinteract to implicate authentication techniques of the present inventionfor trusted graphics pipeline(s).

FIG. 2 provides a schematic diagram of an exemplary networked ordistributed computing environment. The distributed computing environmentcomprises computing objects 10 a, 10 b, etc. and computing objects ordevices 110 a, 110 b, 110 c, etc. These objects may comprise programs,methods, data stores, programmable logic, etc. The objects may compriseportions of the same or different devices such as PDAs, televisions, MP3players, televisions, personal computers, etc. Each object cancommunicate with another object by way of the communications network 14.This network may itself comprise other computing objects and computingdevices that provide services to the system of FIG. 2. In accordancewith an aspect of the invention, each object 10 or 110 may contain anapplication that might request the authentication techniques of thepresent invention for trusted graphics pipeline(s).

It can also be appreciated that an object, such as 110 c, may be hostedon another computing device 10 or 110. Thus, although the physicalenvironment depicted may show the connected devices as computers, suchillustration is merely exemplary and the physical environment mayalternatively be depicted or described comprising various digitaldevices such as PDAs, televisions, MP3 players, etc., software objectssuch as interfaces, COM objects and the like.

There are a variety of systems, components, and network configurationsthat support distributed computing environments. For example, computingsystems may be connected together by wireline or wireless systems, bylocal networks or widely distributed networks. Currently, many of thenetworks are coupled to the Internet, which provides the infrastructurefor widely distributed computing and encompasses many differentnetworks.

In home networking environments, there are at least four disparatenetwork transport media that may each support a unique protocol such asPower line, data (both wireless and wired), voice (e.g., telephone) andentertainment media. Most home control devices such as light switchesand appliances may use power line for connectivity. Data Services mayenter the home as broadband (e.g., either DSL or Cable modem) and areaccessible within the home using either wireless (e.g., HomeRF or802.11b) or wired (e.g., Home PNA, Cat 5, even power line) connectivity.Voice traffic may enter the home either as wired (e.g., Cat 3) orwireless (e.g., cell phones) and may be distributed within the homeusing Cat 3 wiring. Entertainment media may enter the home eitherthrough satellite or cable and is typically distributed in the homeusing coaxial cable. IEEE 1394 and DVI are also emerging as digitalinterconnects for clusters of media devices. All of these networkenvironments and others that may emerge as protocol standards may beinterconnected to form an intranet that may be connected to the outsideworld by way of the Internet. In short, a variety of disparate sourcesexist for the storage and transmission of data, and consequently, movingforward, computing devices will require ways of protecting content atall portions of the data processing pipeline.

The ‘Internet’ commonly refers to the collection of networks andgateways that utilize the TCP/IP suite of protocols, which arewell-known in the art of computer networking. TCP/IP is an acronym for“Transport Control Protocol/Interface Program.” The Internet can bedescribed as a system of geographically distributed remote computernetworks interconnected by computers executing networking protocols thatallow users to interact and share information over the networks. Becauseof such wide-spread information sharing, remote networks such as theInternet have thus far generally evolved into an open system for whichdevelopers can design software applications for performing specializedoperations or services, essentially without restriction.

Thus, the network infrastructure enables a host of network topologiessuch as client/server, peer-to-peer, or hybrid architectures. The“client” is a member of a class or group that uses the services ofanother class or group to which it is not related. Thus, in computing, aclient is a process, i.e., roughly a set of instructions or tasks, thatrequests a service provided by another program. The client processutilizes the requested service without having to “know” any workingdetails about the other program or the service itself. In aclient/server architecture, particularly a networked system, a client isusually a computer that accesses shared network resources provided byanother computer e.g., a server. In the example of FIG. 2, computers 110a, 110 b, etc. can be thought of as clients and computer 10 a, 10 b,etc. can be thought of as the server where server 10 a, 10 b, etc.maintains the data that is then replicated in the client computers 110a, 110 b, etc.

A server is typically a remote computer system accessible over a remotenetwork such as the Internet. The client process may be active in afirst computer system, and the server process may be active in a secondcomputer system, communicating with one another over a communicationsmedium, thus providing distributed functionality and allowing multipleclients to take advantage of the information-gathering capabilities ofthe server.

Client and server communicate with one another utilizing thefunctionality provided by a protocol layer. For example,Hypertext-Transfer Protocol (HTTP) is a common protocol that is used inconjunction with the World Wide Web (WWW). Typically, a computer networkaddress such as a Universal Resource Locator (URL) or an InternetProtocol (IP) address is used to identify the server or client computersto each other. The network address can be referred to as a UniversalResource Locator address. For example, communication can be providedover a communications medium. In particular, the client and server maybe coupled to one another via TCP/IP connections for high-capacitycommunication.

Thus, FIG. 2 illustrates an exemplary networked or distributedenvironment, with a server in communication with client computers via anetwork/bus, in which the present invention may be employed. In moredetail, a number of servers 10 a, 10 b, etc., are interconnected via acommunications network/bus 14, which may be a LAN, WAN, intranet, theInternet, etc., with a number of client or remote computing devices 110a, 110 b, 110 c, 110 d, 110 e, etc., such as a portable computer,handheld computer, thin client, networked appliance, or other device,such as a VCR, TV, oven, light, heater and the like in accordance withthe present invention. It is thus contemplated that the presentinvention may apply to any computing device in connection with which itis desirable to process, store or render secure content from a trustedsource.

In a network environment in which the communications network/bus 14 isthe Internet, for example, the servers 10 can be Web servers with whichthe clients 110 a, 110 b, 110 c, 110 d, 110 e, etc. communicate via anyof a number of known protocols such as HTTP. Servers 10 may also serveas clients 110, as may be characteristic of a distributed computingenvironment. Communications may be wired or wireless, where appropriate.Client devices 110 may or may not communicate via communicationsnetwork/bus 14, and may have independent communications associatedtherewith. For example, in the case of a TV or VCR, there may or may notbe a networked aspect to the control thereof. Each client computer 110and server computer 10 may be equipped with various application programmodules or objects 135 and with connections or access to various typesof storage elements or objects, across which files may be stored or towhich portion(s) of files may be downloaded or migrated. Thus, thepresent invention can be utilized in a computer network environmenthaving client computers 110 a, 110 b, etc. that can access and interactwith a computer network/bus 14 and server computers 10 a, 10 b, etc.that may interact with client computers 110 a, 110 b, etc. and otherdevices 111 and databases 20.

Rights Management (RM) Overview

As is known, and referring now to FIG. 3, rights management (RM) andenforcement is highly desirable in connection with digital content 32such as digital audio, digital video, digital text, digital data,digital multimedia, etc., where such digital content 32 is to bedistributed or redistributed to a user. Upon being received by the user,such user renders the digital content 32 with the aid of an appropriaterendering device such as a media player, text displayer, etc. on apersonal computer 34 or the like.

Typically, a content owner or developer or distributor (hereinafter‘distributor’) distributing such digital content 32 wishes to restrictwhat the user can do with such distributed digital content 32, or atleast ensure that the content 32 is not redistributed in an unwantedmanner. For example, the content distributor may wish to restrict theuser from copying and re-distributing such content 32 to a second user,or may wish to allow distributed digital content 32 to be rendered onlya limited number of times, only for a certain total time, only on acertain type of machine, only on a certain type of rendering platform,only by a certain type of user, etc.

However, and as was set forth above, after distribution has occurred,such distributor has very little if any control over the digital content32. An RM system 30, then, allows the controlled rendering of arbitraryforms of digital content 32, where such control is flexible anddefinable by the content distributor of such digital content. Typically,to protect the content 32, such content 32 is encrypted with a symmetricencryption/decryption key (KD), (i.e., (KD(CONTENT))), and is packagedwith other information relevant to the content 32 in a package 33.

The trust-based RM system 30 allows a distributor of digital content 32to specify at least some license rules that must be satisfied beforesuch digital content 32 is allowed to be rendered by a computing device34 of a user. Such license rules can include the aforementioned temporalrequirement, and may be embodied within a digital license or usedocument (hereinafter ‘license’) 36 that the user/user's computingdevice 34 (hereinafter, such terms are interchangeable unlesscircumstances require otherwise) must possess. Such license 36 alsoincludes the decryption key (KD) for decrypting the digital content 32,perhaps encrypted according to a key decryptable by the user's computingdevice 34. As seen in FIG. 3, such encrypting key is a public key of theuser's computing device 34 (PU-C), and the user's computing device 34presumably has the corresponding private key (PR-C) by which (PU-C(KD))may be decrypted.

The content distributor for a piece of digital content 32 must trustthat the user's computing device 34 will abide by the rules andrequirements specified by such content owner in the license 36, i.e.that the digital content 32 will not be rendered unless the rules andrequirements within the license 36 are satisfied. Preferably, then, theuser's computing device 34 is provided with a trusted component ormechanism 38 that will not render the digital content 32 exceptaccording to the license rules embodied in the license 36 associatedwith the digital content 32 and obtained by the user.

The trusted component 38 typically has a license evaluator 40 thatdetermines whether the license 36 is valid, reviews the license rulesand requirements in such valid license 36, and determines based on thereviewed license rules and requirements whether the requesting user hasthe right to render the requested digital content 32 in the mannersought, among other things. As should be understood, the licenseevaluator 40 is trusted in the RM system 30 to carry out the wishes ofthe owner of the digital content 32 according to the rules andrequirements in the license 36, and the user should not be able toeasily alter such trusted element for any purpose, nefarious orotherwise.

As should be understood, the rules and requirements in the license 36might specify whether the user has rights to render the digital content32 based on any of several factors, including who the user is, where theuser is located, what type of computing device the user is using, whatrendering application is calling the RM system 30, the date, the time,etc. In addition, the rules and requirements of the license 36 may limitthe license 36 to a pre-determined number of renderings, orpre-determined rendering time, for example. Thus, the trusted component38 may need to refer to a clock 42 on the computing device 34. If suchclock 42 is provided, such clock 42 may be a secure clock 42 that cannotbe tampered with by a user in an effort to overcome a temporalrestriction of a license 36.

The rules and requirements may be specified in the license 36 accordingto any appropriate language and syntax. For example, the language maysimply specify attributes and values that must be satisfied (DATE mustbe later than X, e.g.), or may require the performance of functionsaccording to a specified script (IF DATE greater than X, THEN DO . . . ,e.g.).

Upon the license evaluator 40 determining that the license 36 is validand that the user satisfies the rules and requirements therein, thedigital content 32 can then be rendered. In particular, to render thecontent 32, the decryption key (KD) is obtained from the license 36 andis applied to (KD(CONTENT)) from the content package 33 to result in theactual content 32, and the actual content 32 is then in fact rendered.As set forth above, the license 36 with (PU-C(KD)) in effect authorizesan entity in possession of (PR-C) to access (KD) and thereby access thecontent 32 encrypted according to such (KD), presuming of course thatthe entity abides by all conditions as set forth in the license 36.

Note that a license 36 typically includes a digital signature forauthentication/validation purposes. Likewise, other forms of digitalconstructs such as a piece of digital content 32 may also have such adigital signature for authentication/validation purposes. As should beknown, such a digital signature may be constructed based on a first keyfrom a pair of asymmetric keys or from a symmetric integrity key, forexample by performing some sort of hash on the underlying data to whichthe signature is attached and then encrypting the hash with the key.Thereafter, the signature is validated by applying the second key fromthe pair of asymmetric keys or the integrity key, again for example bydecrypting the encrypted hash and comparing the decrypted hash toanother hash of the underlying data to which the signature is attached.If the hashes match, it can be presumed that the underlying data has notbeen altered and the underlying construct therefore can beauthenticated. Typically, an RM system 30 will not honor a license 36 orthe like that is not authenticated.

System for Receiving and Handling Streamed Multimedia Content 32

Turning now to FIG. 4, a system 44 for receiving and handling multimediacontent 32 is shown. As should be evident, such system 44 isparticularly suited for handling an input signal comprising multiplestreams of multimedia content 32, such as for example a televisionsignal from a multi-channel distributor. However, such will be system 44may also handle other input signals without departing from the spiritand scope of the present invention.

In the system 44, the aforementioned input signal as provided by thedistributor thereof is applied to a receiver 46 which may be anyappropriate receiver without departing from the spirit and scope of thepresent invention, presuming of course such receiver can perform thefunctions set forth herein. For example, the receiver 46 may be aUni-Directional Cable Receiver (UDCR) such as is being developed toreceive a digital cable television signal and forward same for furtherdigital processing including rendering of content 32 therein. As may beappreciated, the receiver 46 upon being so commanded tunes one of themultiple streams of multimedia content 32 from the input signal andforwards same for further processing. In addition, the receiver 46 priorto forwarding the tuned stream of content 32 may if necessary convertsuch stream 32 from a native format to a format more amenable for suchfurther processing.

As envisioned, each of the multiple streams of multimedia content 32 inthe input signal may or may not be encrypted. Upon tuning a particularstream of content 32 within the input signal, then, the receiver 46decrypts such stream if encrypted and re-encrypts same in a manner thatwill be set forth in more detail below, or merely encrypts the stream ifnot encrypted, again in a manner that will be set forth in more detailbelow. As was alluded to above, the receiver 46 encrypts the stream ofcontent 32 as part of ensuring that the stream is RM-protected. Thus,the stream of content 32 is not available to be redistributed in anunprotected form.

As also shown in FIG. 4, a media system 48 is provided to receive theencrypted stream of content 32 from the receiver 46 and further processsame. Presumably, the media system 48 commanded the receiver 46 to tunethe particular stream of content 32 from within the input signal,perhaps upon receiving a corresponding command from a user, although itmaybe appreciated that such a command may be initiated by other sourceswithout departing from the spirit and scope of the present invention. Atany rate, upon receiving the stream of content 32 from the receiver 46,the media system 48 stores same in an appropriate storage device 50 forretrieval and rendering, either immediately or upon some time delay.Upon rendering of the stream 32, the media system 48 forwardsappropriate signals to one or more output devices such as one or moremonitors 52, speakers 54, other displays 56, and the like.

Inasmuch as the stored stream 32 is in the RM-protected form, the mediasystem 48 includes RM components such as the trusted component 38,license evaluator 40, and clock 42 of FIG. 3. Thus, upon retrieving aparticular stream 32, the media system 48 renders same, but only inaccordance with a corresponding license 36 as will be set forth in moredetail below. Accordingly, the encrypted stream 32 is decrypted andrendered only if such license 36 so allows, and with the content key(CK) set forth in the license 36. Note that inasmuch as the encryptedstream 32 is stored at least temporarily on the (first) media system 48,a user thereof may in theory copy same to another (second) media system48 for rendering thereby. However, inasmuch as the stream is encryptedand decryptable only according to the license 36, and inasmuch as thelicense 36 is tied to the first media system 48, such license 36 may notbe employed by the second media system 48.

As should be understood, though, it may be the case that the first mediasystem 48 can issue a sub-license 36 for the copied stream 32 to thesecond media system 48, presuming the first media system 48 is in factcapable of doing so and the license 36 so allows. If so, the sub-license36 as tied to the second media system 48 can in fact be employed by thesecond media system 48 to render the stream 32, as will be set forth inmore detail below.

Communicating License Requirements from Receiver 46 to Media System 48

As was set forth above, it is to be appreciated that the receiver 46 canbe expected to receive commands from the media system 48 to tune indifferent digital streams 32 from the input signal on a fairly regularbasis, perhaps on the order of as much as once every one-half to onesecond, especially if a user of the media system 48 is in effectskimming through or ‘surfing’ several streams 32. However, each newlytuned stream 32 requires a new corresponding license 36 with a newcontent key (CK). Typically, such license 36 would be constructed by thereceiver 46 and delivered from the receiver 46 to the media system 48just prior to delivering the tuned stream 32.

However, it is to be appreciated that constructing such new license 36and sending same from the receiver 46 to the media system 48 can bequite burdensome, especially if the license 36 is detailed, includesencrypted elements, includes a digital signature, or the like. Thus, itlikely cannot be expected that the receiver 46 can completely constructa new license 36 for a newly tuned stream 32 every time the media systemcommands such receiver to in fact tune such stream 32. This isespecially true if the frequency of such commands is on the order ofseconds, as is the case for the aforementioned surfing situation. Thisis also especially true if the receiver 46 is not provided withespecially significant computing power as may be necessary to constructsuch license 36 in an expeditious manner. At any rate, a typical usercommanding a new stream 32 to be tuned would expect such new stream 32to be rendered and presented in no more than a second or two after thecommand has been issued.

Clearly, then, the receiver 46 likely cannot send a new license 36 eachtime a stream 32 is newly tuned. Instead, and in one embodiment of thepresent invention, the receiver 46 creates and sends an abbreviated orshortened version of requirements 47 that would go into such a newlicense 36, and the media system 48 upon receiving such requirements 47is trusted by the receiver 46 to construct such a new license 36 onbehalf of the receiver 46, presumably with the aid of computing powergreater than that which is available to the receiver 46.

Presumably, the receiver 46 determines the requirements 47 for thestream 32 from information 49 within the stream 32 itself. Determiningsuch requirements 47 from the information 49 in the stream 32 is knownor should be apparent to the relevant public and therefore need not beset forth herein in any detail, and accordingly any method ofdetermining such requirements 47 from the stream 32 may be employedwithout departing from the spirit and scope of the present invention.For example, it may be the case that the stream 32 as distributed isperiodically supplied with the information 49 at a known interval andlocation.

The requirements 47 as specified for a particular stream 32 by thereceiver 46 may of course be any requirements 47 without departing fromthe spirit and scope of the present invention. Typically, though, therequirements 47 specify at least in part whether the stream 32 as storedin the storage device 50 of a first media system 48 and as licensed tosuch first media system 48 may in fact be copied to and sub-licensed toa second media system 48. For example, such a copy right may be statedas copy freely (CF), copy once (CO), copy never (CN), and the like.

Thus, with the present invention, the receiver 46 need not go to theburden of in fact constructing such new license 36 every time suchreceiver 46 newly tunes a particular stream 32, and the shortenedversion of the requirements 47 of such license 36 can be quickly createdand sent to the media system 48 each time the receiver newly tunes astream 32, even if the user is commanding a change on the order of onceevery second or so.

Moreover, and as may be appreciated, by sending only the requirements 47and not the license 36 itself, the receiver 46 need not be burdened withany particular format of the license 36 itself. Thus, if at some point anew format is specified for the license 36, such format need only becommunicated to the media system 48 and not the receiver 46.

Still referring to FIG. 4, it is seen that in addition to receiving astream 32 from the receiver 46, the media system 48 may additionallyreceive streams 32 from other sources, either directly or indirectly.Such other sources may for example comprise an NTSC input signal, anATSC input signal, and the like. As seen, for each of at least someinput signals received directly, it may be the case that the mediasystem 48 includes either a hardware or software gateway 58 that acts inthe manner of the receiver 46 to both convert a stream 32 within thereceived input signal to an encrypted format more amenable to the mediasystem 48, and also to create and send an abbreviated or shortenedversion of requirements 47 for the stream 32 that would go into a newlicense 36 as created by the media system 48. Here, the gateway 58 coulddetermine the requirements 47 for the stream 32 from the information 49within the stream 32 itself, or could compose default requirements 47 ifnot available from such stream 32.

In one embodiment of the present invention, the requirements 47 asprovided for any particular stream 32 from any particular source are setforth in a common format. Accordingly, the media system 48 need not beconcerned with multiple formats corresponding to different sources. Inone embodiment of the present invention, the common format is of arelatively abbreviated nature such that the requirements 47 can bequickly and easily transmitted to or within the media system 48 and themedia system 48 can likewise quickly construct a license 36 therefrom.

For example, and turning now to FIG. 5, it is seen that in oneembodiment of the present invention, the common format has 32-bitsdivided into a number of pre-defined fields. The fields are defined asfollows:

Input Copy Protection Method—This field specifies an 8-bit value thatcorresponds in a predetermined manner to the particular contentprotection method of the corresponding stream 32. Such contentprotection methods may include but are not limited to:

None—No copy protection is specified for the stream 32, and no RM-basedrestrictions should be imposed on same.

Hardware Macrovision—The stream 32 is Macrovision (waveform) protected.

CGMS-A—The stream 32 contains CGMS-A content protection as specified byIEC 61880 or EIA-608-B.

WSS—The stream 32 contains WSS protection as specified by ITU-R BT1119-1.

Cable Labs Digital Cable—The stream 32 was delivered to a Cable LabsUDCR receiver 46.

ATSC—the stream 32 was delivered in the Advanced Television SystemsCommittee (ATSC) format.

Input Device Meets Robustness Rules—This one-bit field is set to 1 ifthe input device (e.g., a tuner card as the receiver 46) meets therobustness rules defined by the input copy protection method.

Copy Default—This one-bit field is set to 1 if the copy protectionrequirements 47 are not yet known from the stream 32 and default copyprotection is to be applied.

Broadcast Flag/Restricted Content—This one-bit field is unique to ATSCand is set to 1 if the stream 32 is redistribution-controlled.

CIT—This one-bit field is unique to Cable Labs Digital Cable and is setto 1 if the Constrained Image has been triggered.

APS—This two-bit field represents Analog Protection System requirements47 unique to certain Macrovision formats.

Copy Control Value—This two-bit field represents how the stream 32 maybe copied (sub-licensed) from the media system 48 to another mediasystem 48: copy freely (CF), copy once (CO), copy never (CN), and thelike.

Notably, in the one embodiment shown in FIG. 5, 16 of the 32 bits arereserved for later use. Accordingly, features unique to a new type ofcopy protection may be implemented within the reserved bits, as may beadditional features already present in current types of copy protection.Also notably, specific bits that currently are reserved for use only inconnection with certain types of copy protection, and therefore not ofuse in connection with other types of copy protection, may neverthelessbe employed in connection with such other types of copy protection fordifferent purposes.

As may now be appreciated, by employing a common format to represent therequirements 47 for a license 36 corresponding to a particular stream32, such requirements 47 can be specified in a common manner that isagnostic to any particular format of such stream 32 as distributed. Therequirements 47 are succinctly specified in a manner not specific to anyparticular source content protection mechanism, and a relatively simpledevice such as the receiver 46 or a gateway 58 (hereinafter, ‘receiver46’ unless circumstances dictate otherwise) can derive the requirements47 from any specific format and translate same into a common format.

Turning now to FIG. 6, it is seen that a method employed by the receiver46 in response to a command to tune a particular stream 32 is shown. Asmay be appreciated, such command is typically issued initially by a userto the media system 48 (step 601) and then from the media system 48 tothe receiver 46 (step 603), although the media system may alternatelyissue such tuning command without prompting from the user withoutdeparting from the spirit and scope of the present invention. At anyrate, in response to the tuning command, the receiver 46 in fact tunesthe stream 32 at issue (step 605). Such tuning is generally known orshould be apparent to the relevant public and therefore need not be setforth herein in any detail. Accordingly, such tuning may be performed inany appropriate manner without departing from the spirit and scope ofthe present invention.

Once tuned, the receiver 46 decrypts the stream 32 if necessary (step607) and re-encrypts same according to a symmetric content key (CK) thatis shared with the media system 48 (step 609). One method of sharingsuch content key (CK) with the media system 48 is set forth below,although it is to be appreciated that most any such method may beemployed without departing from the spirit and scope of the presentinvention.

In addition, from the decrypted stream 32, the receiver 46 may locatethe aforementioned information 49 relating to the requirements 47 for alicense 36 corresponding to the stream 32 (step 611). As was set forthabove, such information 49 with such requirements 47 may be periodicallysupplied within the stream 32 at a known interval and location. Forexample, such known interval may be on the order of once every 20seconds, and the location may be a particular identified packet if thestream 32 is digital or a particular video blanking interval if thestream 32 is analog. As will be set forth below in more detail, in thecase where the receiver 46 has not as yet encountered such information49 in the stream 32, and where waiting for such information 49 is notfeasible, the receiver 46 may proceed by sending requirements 47 basedon some default set of information 49 and at a later time when actualinformation 49 is received send actual requirements 47.

At any rate, with the located information 49, the receiver 46 constructsa set of requirements 47 corresponding to the stream 32 (step 613),where such requirements 47 may be expressed in the aforementioned commonformat, and sends such requirements 47 to the media system 48 (step615), and in particular to the trusted component 38 of the media system48. Thereafter, the media system 48 constructs a license 36 based on therequirements 47 (step 617) and stores such constructed license 36 in alicense store 60 thereof or the like (step 619).

Constructing such license 36 from such requirements 47 is generallyknown or should be apparent to the relevant public and therefore neednot be set forth herein in any detail. Accordingly, such construction ofsuch license 36 may be performed in any appropriate manner withoutdeparting from the spirit and scope of the present invention. Forexample, and in the case where the requirements 47 are expressedaccording to the 32-bit common format set forth above or the like, themedia system 48 may employ a mapping algorithm that maps each field ofbits to a license 36 according to pre-defined mapping rules.

Note that in constructing the license 36, the media system 48 presumablystores the content key (CK) for the stream, which may be obtained in amanner set forth below, within the license 36 encrypted according toanother key such as a public key of such media system 48 (PU-MS) toresult in (PU-MS(CK)). Thus, only that media system 48 may access (CK)from (PU-MS(CK)) from the license 36 with the aid of a private key(PR-MS) corresponding to (PU-MS). As a result, such license 36 may besaid to be tied to such media system 48 and may not be employed by anyother media system 48 or other device. If the license 36 authorizes themedia system 48 to issue a sub-license 36 for another media system 48 torender the stream 32 by for example stating a copy right such as copyfreely (CF) or copy once (CO), such media system 48 in creating thesub-license 36 must first apply (PR-MS) to (PU-MS(CK)) to reveal (CK)and then must encrypt (CK) according to a (PU-MS) of the another mediasystem 48, and then may insert such a new (PU-MS(CK)) into thesub-license 36.

Note that the media system 48 is likely in possession of the content key(CK) for a particular stream 32 prior to constructing a correspondinglicense 36 for same, and therefore may employ such content key (CK) todecrypt the encrypted stream as sent from the receiver 46 and rendersuch decrypted stream 32 (step 621). One may therefore question the needfor the media system to construct and store the license as at steps 617and 619. However, it should be appreciated that the stored license 36may be used by the media system 48 if need be to retrieve the contentkey (CK), such as for example if the media system 48 somehow loses such(CK) during a reset or the like. Likewise, if the media system 48 isplaying back the stream 32 from the storage device 50 on a delayedbasis, the license 36 may be the only location where such (CK) isstored. Also, the license 36 is necessary to store and retrieve any copyrights associated with the stream 32, as well as the other requirements47 corresponding to the stream 32, which may need to be referred to atsome future point.

Note that for any particular stream 32, it may be the case that theinformation 49 thereof may change one or more times. If so, and as maybe appreciated, the receiver 46 should issue new requirements 47 to themedia system 48 as at steps 613 and 615 and the media system shouldconstruct and store a new license 36 as at steps 617 and 619. Thus, thereceiver 46 should be aware of each set of information 49 within thestream 32 and should note when such set of information 39 has changedwithin the stream 32.

Sharing Content Keys Between Receiver 46 and Media System 48

As was set forth above, each time the receiver 46 tunes a differentstream 32, the receiver sends the newly tuned stream 32 encryptedaccording to a different content key (CK), and also sends a set ofcorresponding requirements 47. Thus, the receiver 46 and the mediasystem 48 must somehow share content keys (CK), and in particular themedia system 48 must know what content key (CK) the receiver 46 hasemployed to encrypt a particular stream 32.

However, and significantly, it is not presently envisioned that thereceiver 46 transmit each content key (CK) for each particular stream 32to the media system 48, for example as part of the requirements 47 orwithin a typical RM license 36. As was set forth above, the receiver 46cannot be expected to construct and send such a typical RM license 36for each newly tuned stream 32 because constructing such a license 36 isso labor-intensive and because it can be the case that a newly tunedstream 32 can be commanded as often as once every second or so. Thus,the receiver 46 and the media system 48 must somehow share such contentkey (CK) through a different method of communication.

Accordingly, and in one embodiment of the present invention, thereceiver 46 and the media system 48 as part of an initialization sharean initial content key (CK0) by way of a more-or-less typical RM license36, and then each of the receiver 46 and the media system 48 derive anew content key (CKx) from (CK(0)), either directly or indirectly, on anas-needed basis and in a coordinated fashion. Significantly, theinitialization RM license 36 is required only once until anotherinitialization is necessary, and accordingly the labor-intensive aspectsof such RM license 36 are encountered only once until anotherinitialization is necessary. Note that such an initialization may beperformed according to any appropriate interval without departing fromthe spirit and scope of the present invention. For example, aninitialization may be performed once every few hours or few days or so,or may be performed once each time the media system 48 is started or isreset.

In one embodiment of the present invention, and turning now to FIG. 7,upon an initialization event, the media system 48 sends aninitialization request to the receiver 46 (step 701), where suchinitialization request includes a machine certificate or the like issuedto the media system 48 by an authority or chain of authority trusted bythe receiver 46. Significantly, the sent machine certificate includes apublic key of the media system (PU-MS), and the media system is inpossession of a corresponding private key (PR-MS).

Thereafter, the receiver 46 satisfies itself based on the sent machinecertificate that the media system 48 may be trusted, constructs theinitialization RM license 36 (step 703), and sends the initializationlicense 36 to the media system 48 (step 705). Significantly, theinitialization license 36 includes an initial content key (CK0) asdecided upon by the receiver 46, where such initial content key (CK0) isencrypted according to the public key (PU-MS) from the machinecertificate to result in (PU-MS(CK0)). Thus, the media system 48 uponreceiving the initialization license 36 and storing same in a licensestore 60 retrieves such (PU-MS(CK0)) therefrom and applies (PR-MS)thereto to result in (CK0) (step 707), and then stores such (CK0) in anappropriate secure location along with a count, which here would be setto zero (step 709). As may be appreciated, the receiver 46 also storessuch (CK0) in an appropriate secure location along with the same zerocount.

Note that the initialization license 36 may be signed by the receiver46, in which case the receiver may employ a symmetric integrity key (IK)to in effect sign such initialization license 36 based on a symmetricsigning protocol such as a MAC. If so, and in one embodiment of theinvention, the initial content key (CK0) and the integrity key (IK) asan initial integrity key (IK0) are both encrypted according to thepublic key (PU-MS) from the machine certificate to result in (PU-MS(CK0,IK0)). Here, then, the media system 48 upon receiving the initializationlicense 36 retrieves such (PU-MS(CK0, IK0)) therefrom and applies(PR-MS) thereto to result in (CK0) and (IK0) as at step 707, and thenstores such (CK0) and (IK0) and zero count in an appropriate securelocation as at step 709. In addition, the media system 48 employs suchinitial integrity key (IK0) to verify the signature of suchinitialization license 36.

To summarize thus far, then, both the receiver 46 and the media system48 have stored in a secure location an initial content key (CK0), aninitial integrity key (IK0) and a count set to zero. However, thereceiver has not yet begun to send the stream 32 to the media system 48encrypted according to any content key (CK), or any correspondingrequirements 47. Presumably, though, the media system 48 at some pointdoes command a first instance of such a situation, as at step 603 ofFIG. 6. Accordingly, the receiver proceeds with the steps of such FIG. 6to the point where such receiver requires a first new symmetric contentkey (CKx), which would be (CK1), to encrypt a first stream 32, as atstep 609.

Here, and in one embodiment of the present invention, the receiver 46generates such content key (CKx)/(CK1) by incrementing the count (step711) and deriving (CKx)/(CK1) from the initial content key (CK0) (step713). Moreover, when deriving such a content key (CKx) from such initialcontent key (CK(0)), the receiver 46 also derives a correspondingintegrity key (IKx)/(IK1) from the initial integrity key (IK0) (step715).

In one embodiment of the present invention, both the content key (CKx)and the integrity key (IKx) are derived from (CK(0)) and (IK(0)),respectively, by applying the initial value (CK(0)) or (IK(0)) afunction along with the new count value:value(x)=function(value(0),count)For example, such function may a one-way hash function such as a SHAfunction, perhaps with appropriate truncation or lengthening as need be.Thus, with such content key (CKx), the receiver 46 may encrypt thestream 32 as at step 609.

In one embodiment of the present invention, the receiver 46 communicatesthe derivation or rotation of such keys (CKx, IKx) and the new count tothe media system 48 when the receiver 46 constructs the set ofrequirements 47 corresponding to the stream 32 and sends suchrequirements 47 to the media system 48, as at steps 613 and 615 of FIG.6. In particular, and in one embodiment of the present invention, thereceiver 46 when performing such steps 613 and 615 in fact constructs aderived message 62 with values therein that are based on the values inthe initialization license 36 sent as at step 705.

In particular for any particular stream 32 corresponding to a particularcount x, such as for example the first stream 32 corresponding tocount=1, the receiver 46 constructs a derived message 62 including: therequirements 47 for such stream 32, the count x, and a signature basedon the integrity key (IKx) (step 717), and sends the constructed derivedmessage 62 to the media system 48 (step 719). Note that inasmuch as thesignature is based on a symmetric key, constructing such a derivedmessage 62 is not nearly as burdensome to the receiver 46 as comparedwith a signature based on an asymmetric key.

At any rate, upon receiving the stream 32 and the derived message 62corresponding thereto, the media system 48 can itself derive thecorresponding content key (CKx) and integrity key (IKx) based onknowledge of the count from such received derived message 62, (CK(0)),(IK(0)), and the function used at step 715. In particular, and as withthe receiver 46, the media system 48 locates each of (CK(0)) and (IK(0))(step 721), derives (CKx) and (IKx) by employing the same function asthe receiver 46 and the current count x (step 723), and stores suchderived (CKx) and (IKx) along with the corresponding count as may beappropriate (step 725). In addition, the media system 48 employs suchintegrity key (IKx) to verify the signature of the corresponding derivedmessage 62 (step 727). Most significantly, with the content key (CKx)corresponding to the stream 32, and presuming the corresponding derivedmessage 62 verifies and allows, the media system 48 can decrypt thestream 32 for rendering and/or further processing (step 729).

It should be noted that the derived message 62 as received from thereceiver 46 by the media system 48 is not the license 36 constructed andstored by the media system 48 in a license store 60 as at steps 617 and619 of FIG. 6. Instead, and as should be appreciated, the derivedmessage 62 contains the requirements 47 that are employed to constructthe license 36 of such steps 617 and 619.

With the present invention as set forth herein, the receiver 46 need notexplicitly communicate a content key (CKx) or integrity key (IKx) to themedia system 48 for every newly tuned stream 32. Instead, the receiver46 need only establish initial values of such keys (CK0, IK0) with themedia system 48, and then each of the receiver 46 and the media system48 can independently derive new values (CKx, IKx) for each new stream 32based on prior knowledge of (CK(0), IK(0)) and the deriving function.Thus, the receiver 46 need not go to the considerable burden ofconstructing a typical RM license 36 for each new stream 32, with (CKx)asymmetrically encrypted therein and such RM license beingasymmetrically signed. Instead, the receiver 46 need only construct sucha typical RM license 36 when initializing with the media system 48, andthereafter can construct a less-burdensome derived message 62 for eachnew stream 32, without (CKx) encrypted therein and being symmetricallysigned.

Note that in an alternate embodiment of the present invention, ratherthan deriving (CKx) and (IKx) from (CK(0)) and (IK(0)), respectively,such (CKx) and (IKx) may be derived from (CK(x−1)) and (IK(x−1)),respectively. As should be appreciated, doing so is similar to deriving(CKx) and (IKx) from (CK(0)) and (IK(0)) in most respects except that(CK(x)) and (IK(x)) need to be stored and retrieved for deriving(CK(x+1)) and (IK(x+1)), as may be appreciated.

Note too that in sharing the content keys between the receiver 46 andthe media system 48, such elements may communicate with each other usingsecure methods, such as for example authentication and the like.Alternatively, if circumstances warrant, un-secure methods may also beemployed.

Default Derived Message 62

As was set forth and/or alluded to above, in constructing a derivedmessage 62 corresponding to a particular newly tuned stream 32, thereceiver 46 locates the information 49 relating to the requirements 47for the derived message 62 from the stream 32, as at step 611, wheresuch information 49 with such requirements 47 may be periodicallysupplied within the stream 32 at a known interval and location. Suchknown interval may be on the order of once every 20 seconds or longer,and accordingly it is likely very often the case that the receiver 46will not encounter such information 49 in the stream 32 without havingto wait a considerable length of time. However, such a wait is notfeasible, especially if the receiver 46 is expected to send such aderived message 62 with requirements 47 based on such information 49within the time frame of a second or so after being commanded to tunethe stream 32.

Accordingly, in one embodiment of the present invention, if the receiver46 is not in possession of the information 49 from the newly tunedstream 32 in time to construct requirements 47 based thereon, theinformation 49 is placed in a corresponding derived message 62, and thederived message 62 is sent in a timely manner, as at steps 715 and 717of FIG. 7, and the receiver 46 instead constructs and sends a defaultderived message 62. As may be appreciated, such default derived message62 includes requirements 47 that are most-restrictive in nature, such asfor example copy never (CN). Thereafter, when the receiver 46 is in factin possession of the information 49 from the newly tuned stream 32, thereceiver 46 then constructs and sends an actual derived message 62. Asmay be appreciated here, such actual derived message 62 includesrequirements 47 that are in fact based on such possessed information 49,and that are meant to replace the requirements 47 from the correspondingdefault derived message 62.

In particular, and turning now to FIG. 8, upon tuning a newly commandedstream 32 (step 801), the receiver 46 increments the count and derives a(CKx) and (IKx) for the stream as at steps 709-713 (step 803). However,presuming that the aforementioned information 49 pertaining to therequirements 47 has not as yet been encountered in the newly tunedstream 32 in a timely manner, the receiver 46 constructs and sends adefault derived message 62 that includes default requirements 47 thatare most-restrictive in nature, such as for example copy never (CN)(step 805). Thereafter, the receiver 46 waits until the information 49from the newly tuned stream 32 is in fact encountered (step 807), wheresuch waiting can last as long as 20 seconds or even a manner of minutesin certain circumstances.

Upon in fact encountering the information 49 in the stream 32, thereceiver 46 then constructs and sends an actual derived message 62 thatincludes actual requirements 47 that are in fact based on suchencountered information 49 (step 815), such actual requirements 47 inthe actual derived message 62 are meant to replace the defaultrequirements 47 from the corresponding default derived message 62.Significantly, and in one embodiment of the present invention, thereceiver 46 in constructing and sending the actual derived message 62 asat step 815 does not increment the count (step 813), and thus thedefault derived message 62 and the corresponding actual derived message62 have the same count noted therein.

As may now be appreciated, upon receiving the default derived message62, and as before, the media system 48 derives the corresponding contentkey (CKx) and integrity key (IKx) as at steps 721 and 723 of FIG. 7,employs such integrity key (IKx) to verify the signature of such defaultderived message 62 as at step 725, and with the content key (CKx) themedia system 48 can decrypt the stream 32 as at step 727 (step 809).Significantly, inasmuch as such default derived message 62 has thedefault requirements 47 that are most-restrictive in nature, the mediasystem also constructs and stores a default-version license 36 in alicense store 60 as at steps 617 and 619 of FIG. 6 that is based on suchdefault requirements 47 and that as a result is highly restrictive in asignificant respect (step 811).

However, upon later receiving the actual derived message 62, and inparticular upon noting that the count value in such actual derivedmessage 62 has not changed from the count value of the default derivedmessage 62, the media system 48 in one embodiment of the presentinvention understands the unchanged count value to mean that the actualderived message 62 includes actual requirements 47 that are to replacethe default requirements 47 from the default derived message 62 (step817). Alternatively, the media system 48 may note from copy defaultfield in the requirements 47 in the default derived message 62 that suchmessage 62 is in fact default in nature, and then await thecorresponding actual derived message 62.

Accordingly, the media system 48 need not derive the correspondingcontent key (CKx) and integrity key (IKx) as at steps 721 and 723 ofFIG. 7, although such media system 48 does employ the integrity key(IKx) as derived in connection with the default derived message 62 toverify the signature of the actual derived message 62 as at step 725,and employs the content key (CKx) as derived in connection with thedefault derived message 62 to continue to decrypt the stream 32 as atstep 727 (step 819). Significantly, inasmuch as the actual derivedmessage 62 has the actual requirements 47 that could be less-restrictivein nature, the media system 48 also constructs and stores anactual-version license 36 in a license store 60 as at steps 617 and 619of FIG. 6 that is based on such actual requirements 47 and that is toreplace the corresponding default-version license 36 based on thedefault requirements 47 (step 821).

Note that for the amount of time that the stream 32 can be renderedaccording to the default-version license 36 based on the defaultrequirements 47, a user likely cannot do anything with such stream 32 inthe nature of copying and the like. However, inasmuch as thecorresponding actual derived message 62 should be received by the mediasystem 48 at most about 20 seconds to a few minutes after the defaultderived message 62, and at such time the actual-version license 36 basedon the actual requirements 47 would replace the default-version license36 based on the default requirements 47, the time frame where suchstream 32 is so restrictively controlled is relatively small to thepoint of being insignificant.

At any rate, by providing the default derived message 62 to the mediasystem 48 prior to locating actual requirements 47 from which an actualderived message 62 may be provided, the receiver 46 at least allows themedia system 48 to render the corresponding stream 32 in an expeditiousmanner so that the user of such media system 48 can experience therendered stream 32 promptly and without an undesirable amount of delay.When the actual derived message 62 is eventually provided to the mediasystem 48, such media system can then construct the correspondingactual-version license 36 based on the actual requirements 47 and canreplace the default-version license 36 based on the default requirements47 without any real loss.

Temporary License Store 60

In a typical RM architecture, a license 36 created for and correspondingto a piece of content 32 should be available for as long as the content32 is available. Thus, if the content 32 is for example a document thatis expected to be present for ten years, then the corresponding license36 should also be present in a license store 60 for the same ten years.Correspondingly, if the content 32 is for example an ephemeral signalsuch as a stream 32 that is expected to be present for a very shortperiod of time, then the corresponding license 36 should also be presentin a license store 60 for the same very short period of time, ideally.

Thus, in the scenario of FIG. 4 where a receiver 46 can be expected totune many streams 32, perhaps as fast as once every second or so, it isto be appreciated that the corresponding licenses 36 as stored by themedia system 48 in a license store 60 are for the most part barely usedand once used are never to be used again. Moreover, the shear volume ofsuch licenses 36 as stored by the media system 48 in a license store 60can quickly approach huge quantities. Further, by storing so manylicenses 36 in such a license store 60, searching for and finding thosefew licenses 36 that are indeed needed for a relatively long period oftime can be cumbersome and slow.

Thus, in one embodiment of the present invention, licenses 36 as storedby the media system 60 are segregated according to first, relativelyshort lived, licenses 36 and second, relatively long lived, licenses 36for maintaining content having a useful life longer than the useful lifefor content rendered in accordance with the short lived licenses.Moreover, in such embodiment, relatively short lived licenses 36 arestored in a more temporary and volatile license store 60 of the mediasystem 48 and relatively long lived licenses 36 are stored in a morepermanent and non-volatile license store 60 of the media system 48. Forexample, the temporary license store 60 may be located in RAM memory ofthe media system 48, while the permanent license store 60 may be locatedin a fixed drive memory of the media system 48, although other types ofsuch memory may be employed without departing from the spirit and scopeof the present invention.

In one embodiment of the present invention, the media system 48 placeslicenses 36 in the permanent license store 60 that correspond tolong-lived streams 32 that a user or the like has directed to be savedto the storage device 50 for later playback or copying to another mediasystem 48 or the like. Thus, all other licenses 36, which presumablywould be for short-lived, more ephemeral streams 32, would be placed bythe media system 48 into the temporary license store 60. As may beappreciated, when the permanent license store 60 is non-volatile, thelicenses 36 therein are maintained (i.e. not deleted) whenever the mediasystem 48 is turned off or reset, and accordingly can be employed torender the corresponding long-lived streams 32 on an indefinite basis.Note though that licenses 36 can and should be deleted from thepermanent license store 60 when no longer needed.

When the temporary license store 60 is volatile, however, the licenses36 therein are deleted whenever the media system 48 is turned off orreset. However, such a deletion is by implication, and it is to beappreciated that a more explicit method of deletion is also necessary inthe event that the media system 48 runs for a relatively long period oftime, during which such temporary license store can become filled and/orclogged.

Thus, in one embodiment of the present invention, the media system 48explicitly commands a deletion of a license 36 in the temporary licensestore 60 at certain times when such media system 48 deems that suchlicense 36 is no longer needed. Such certain times may be anyappropriate times without departing from the spirit and scope of thepresent invention. For example, it may be the case that the media system48 commands deleting a license 36 when the corresponding stream 32 is nolonger tuned by the receiver 46, such as for example when the receiver46 is commanded by the media system 48 to tune another stream 32.

However, it is to be appreciated that in fact deleting such a license 36so quickly may be premature. For example, it may be that information insuch to-be-deleted license 36 is still needed, or that the stream 32corresponding thereto may be re-tuned in a short period of time.Likewise, it may be the case that although one process of the mediasystem 48 no longer requires a license 36 and has commanded a deletionof such license 36, another process may still require same.

Accordingly, in one embodiment of the present invention, and turning nowto FIG. 9, any process of the media system 48 that wishes to delete alicense 36 from the temporary license store 60 does so not by in factdeleting same but instead by marking such license 36 with an appropriatemark such as a flag or the like (step 901). As may be appreciated, suchflag may be represented by a bit reserved in the license 36 for such useand appropriately set, may be a similar bit in a reference tablemaintained by the temporary license store 60, or the like. Thus, asmarked, such license 36 is not immediately deleted and can be employedby any other process of the media system 48 requiring same.

At a later time after the license 36 has in fact been marked fordeletion, then, and presumably well after any other process of the mediasystem could require use of such marked license 36, the media system 48in fact deletes such marked license 36 by way of actuating ahousekeeping process or the like (step 903). In particular, and as maybe appreciated, such a housekeeping process of the media system 48 wouldbe periodically actuated thereby to examine each license 36 in thetemporary license store 60 (step 905), determine if the license 36 is infact marked for deletion (step 907), and if so in fact delete suchmarked license 36 from the temporary license store 60 (step 909).

With the present invention, then, licenses 36 that are not needed for arelatively long period of time are segregated from other licenses 36 bybeing stored in a temporary license store 60 that is volatile in nature.Moreover, to prevent the temporary license store 60 from becomingcongested with too many such licenses 36, such licenses 36 are markedfor deletion when no longer needed, and a housekeeping processperiodically in fact deletes such marked licenses 36 from the temporarylicense store 60.

CONCLUSION

The programming necessary to effectuate the processes performed inconnection with the present invention is relatively straight-forward andshould be apparent to the relevant programming public. Accordingly, suchprogramming is not attached hereto. Any particular programming, then,may be employed to effectuate the present invention without departingfrom the spirit and scope thereof.

In the present invention, a system and method are provided for thereceiver 46 to create a shortened version of requirements 47 that are tobe employed to construct a license 36 such that the receiver 46 need notgo to the burden of in fact completely creating such new license 36every time such receiver 46 newly tunes a stream 32. The shortenedversion of such requirements 47 can be quickly created and sent to themedia system 48 each time the receiver 46 newly tunes a stream 32, evenif the user is commanding a change on the order of once every second orso. Additionally, the shortened version of such requirements 47 isconcise and yet describes all license requirements for the tuned stream32 in a minimal amount of space. The format of such requirements 47 canbe employed in connection with streams 32 as provided to the mediasystem 48 from sources other than the receiver 46.

Also in the present invention, a system and method are provided forsharing each new content key (CK) between the receiver 46 and the mediasystem 48 without the need for creating an actual license 36 with eachsuch content key (CK) therein. The receiver 46 and media system 48exchange an initial content key (CK0) and then rotate content keys (CKx)based on the initial content key (CK0) in a coordinated fashion.

Moreover, in the present invention, a system and method are provided forthe receiver 46 to send a default set of requirements 47 on apreliminary basis, and then an actual set of requirements 47 whenactually located. Such default requirements 47 are employed by the mediasystem 48 until the actual requirements 47 are sent, and the mediasystem 48 can distinguish between such default requirements 47 and suchcorresponding actual requirements 47 and can replace the defaultrequirements 47 with the corresponding actual requirements 47 uponreceipt thereof.

Finally, in the present invention, a system and method are provided forthe media system 48 to store at least some licenses 36 corresponding totuned streams 32 only on a temporary basis. The media system 48 canrecognize which licenses 36 need only be stored on a temporary basis,and the media system deletes such temporarily stored licenses when nolonger needed.

It should be appreciated that changes could be made to the embodimentsdescribed above without departing from the inventive concepts thereof.It should be understood, therefore, that this invention is not limitedto the particular embodiments disclosed, but it is intended to covermodifications within the spirit and scope of the present invention asdefined by the appended claims.

1. A method for a computing device to store digital licenses for rendering corresponding pieces of digital content, the method comprising: the computing device receiving a first license corresponding to a first content and a second license corresponding to a second content, wherein each of the first content and the second content are corresponding streams of digital content tuned from a combined signal comprising a plurality of streams of digital content, and wherein the second content has been directed to be saved to a storage device for subsequent playback or copying and the first content has not been directed to be saved to a storage device for subsequent playback or copying; the computing device storing the first license in a temporary license store; the computing device storing the second license in a permanent license store; the computing device deleting the first license when the temporary license store is turned off or reset; and the computing device maintaining the second license in the permanent license store when the permanent license store is turned off or reset.
 2. The method of claim 1 wherein storing the first license comprises the computing device storing the first license in the temporary license store established in a RAM memory of the computing device.
 3. The method of claim 1 wherein storing the second license comprises the computing device storing the second license in the permanent license store established in a fixed drive memory of the computing device.
 4. The method of claim 1 further comprising the computing device explicitly commanding a deletion of the first license in the temporary license store at a time when such computing device deems that the first license is no longer needed.
 5. The method of claim 4 comprising the computing device commanding the deletion of the first license in the temporary license store by marking the first license for deletion, and further comprising: after marking the first license for deletion, the computing device actuating a license housekeeping process; the license housekeeping process examining each license in the temporary license store and determining if each license is marked for deletion; and if so, the computing device deleting marked licenses from the temporary license store.
 6. A computer-readable storage medium having stored thereon computer-executable instructions implementing a method for a computing device to store digital licenses for rendering corresponding pieces of digital content, the method comprising: the computing device receiving a first license corresponding to a first content and a second license corresponding to a second content, wherein each of the first content and the second content are corresponding streams of digital content tuned from a combined signal comprising a plurality of streams of digital content, and wherein the second content has been directed to be saved to a storage device for subsequent playback or copying and the first content has not been directed to be saved to a storage device for subsequent playback or copying; the computing device storing the first license in a temporary license store; the computing device storing the second license in a permanent license store; the computing device deleting the first license when the temporary license store is turned off or reset; and the computing device maintaining the second license in the permanent license store when the permanent license store is turned off or reset.
 7. The medium of claim 6 wherein storing the first licenses comprises the computing device storing the first licenses in a temporary license store established in a RAM memory of the computing device.
 8. The medium of claim 7 wherein storing the second licenses comprises the computing device storing the second licenses in a permanent license store established in a fixed drive memory of the computing device.
 9. The medium of claim 7 wherein the method further comprises the computing device explicitly commanding a deletion of a license in the temporary license store at a time when such computing device deems that such license is no longer needed.
 10. The medium of claim 9 wherein the method comprises the computing device commanding the deletion of the license in the temporary license store by marking the license for deletion, and further comprises: after marking the license for deletion, the computing device actuating a license housekeeping process; the license housekeeping process examining each license in the temporary license store and determining if the license is marked for deletion; and if so, the computing device deleting such marked license from the temporary license store.
 11. A computing device adapted to store digital licenses for rendering corresponding pieces of digital content, comprising: a processor programmed to: receive a first license corresponding to a first content and a second license corresponding to a second content, wherein each of the first content and the second content are corresponding streams of digital content tuned from a combined signal comprising a plurality of streams of digital content, and wherein the second content has been directed to be saved to a storage device for subsequent playback or copying and the first content has not been directed to be saved to a storage device for subsequent playback or copying; a temporary license store that stores the first license; and a permanent license store that stores the second license, wherein the processor is further programmed to delete the first license when the temporary license store is turned off or reset and to maintain the second license in the permanent license store when the permanent license store is turned off or reset.
 12. The device of claim 11 wherein the temporary license store comprises a RAM memory of the computing device.
 13. The device of claim 11 wherein the permanent license store comprises a fixed drive memory of the computing device.
 14. The device of claim 13 wherein the processor deletes a license in the temporary license store at a time when such license is no longer needed.
 15. The device of claim 14 wherein the processor is further programmed to mark the license for deletion and programmed to actuate a license housekeeping process after marking the license for deletion, the license housekeeping process examining each license in the temporary license store, determining if the license is marked for deletion, and, if so, deleting such marked license from the temporary license store. 